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ABSTRACT 


The utility of on-orbit servicing of 
spacecraft has been demonstrated by NASA 
several times using shuttle-based astronaut 
EVA. There has been interest in utilizing 
on-orbit servicing for military space 
systems as well. This interest has been 
driven by the increasing reliance of all 
branches of the military upon space-based 
assets, the growing numbers, complexity, and 
cost of those assets, and a desire to 
normalize support policies for space-based 
operations . 

Many military satellites are placed in 
orbits which are unduly hostile for 
astronaut operations and/or cannot be 
reached by the shuttle. In addition, some 
of the projected tasks may involve hazardous 
operations. This has led to a focus on 
robotic systems, instead of astronauts, for 
the basis of projected servicing systems. 

This paper describes studies and activities 
which will hopefully lead to on-orbit 
servicing being one of the tools available 
to military space systems designers and 
operators. The utility of various forms of 
servicing has been evaluated for present and 
projected systems, critical technologies 
have been identified, and strategies for the 
development and insertion of this technology 
into operational systems have been 
developed . 

Many of the projected plans have been 
adversely affected by budgetary restrictions 
and evolving architectures, but the 
fundamental benefits and requirements are 
well understood. A method of introducing 
servicing capabilities in a manner which has 
a low impact on the system designer and does 
not require the prior development of an 
expensive infrastructure is discussed. This 
can potentially lead to an evolutionary 
implementation of the full technology. 
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1. HISTORY OF SPACE-BASED SERVICING 

Space-based systems are very valuable for 
many diverse applications. They are also 
very expensive to build and to place into 
orbit. Although satellites are designed to 
high standards and extensively tested on the 
ground, they have suffered from the rang^ 
and rate of anomalies to be expected fro 
such complex systems. 

For the first 15 years of space activity, 
troubled systems could be salvaged only by 
creative reprogramming from the ground. For 
example, a Tracking and Data Relay Satellite 
(TDRSS) was raised into a useful orbit using 
its attitude control thrusters following a 
problem with the IUS. If such a work-around 
could not be achieved, there was no 
alternative but to launch a replacement 
system. 

Once man began gaining regular access to 
space, the alternative of direct action on 
the problems became possible. There have 
been a number of space missions which have 
been saved by corrective actions taken by 
astronauts performing Extra Vehicular 
Activities (EVA) . The first of these was 
on the initial deployment of Skylab in 1973 
when repairs were made to the solar panels 
and thermal shield which had been damaged 
during launch. Had it not been for this 
manual improvisation, the vehicle would have 
been unusable. 

In 1984, an EVA repair mission from the 
shuttle replaced a failed attitude control 
module on the Solar-Max satellite and 
restored that vehicle and its payload to 
full operational status. An additional 6 
years of valuable data was obtained as a 
result of this repair. There were plans to 
revisit this satellite in 1990 for a second 
servicing mission to recover it before re- 
entry, but the only available flight 
opportunity was pre-empted by the recovery 
of the Long Duration Exposure Facility. 
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A pair of communication satellites, Palapa 
and Westar, were stranded in low earth orbit 
due to failures in their boost propulsion 
systems. Although these satellites were not 
originally designed with provisions for 
orbital handling, an on-orbit recovery 
mission was carried out from the shuttle in 
1985. The spacecraft were recovered by 
astronaut EVA operations, refurbished, and 
later relaunched. 

The most recent example of a space mission 
being saved by on-orbit action is the 
deployment of the Gamma Ray Observatory 
(GRO) on STS-37 . After the high-gain 
antenna failed to deploy, the crew performed 
an EVA which successfully freed a stuck boom 
by using a crank designed for ground 
operations. Without this corrective action, 
the $650 million spacecraft would have been 
unable to return useful data to earth. 

The Soviets have also salvaged several 
missions by on-orbit repairs of their 
Salyut/MIR space stations. Problems they 
have corrected by EVA range from the release 
of jammed mechanisms to the replacement of 
portions of a fluid system, which involved 
cutting and welding tubing. 


2. MILITARY INTEREST IN SPACE SERVICING 

These demonstrations created an interest 
within the Department of Defense in the 
benefits of space servicing operations. The 
use of space-based systems has become an 
integrated part of military doctrine, and 
the number, complexity, and expense of these 
systems is projected to increase in the 
future. This growing military reliance upon 
space requires that the systems meet the 
required operational availability and be 
fielded and operated within budgetary 
constraints. It was recognized that 
extending the service life of space-based 
assets by correcting conditions which would 
otherwise terminate the mission could reduce 
the life cycle costs and increase the 
operational utility of military systems. 

Military interest in space-servicing 
techniques was given a major stimulus by the 
Strategic Defense Initiative (SDI) . The 
early SDI architectures featured large 
constellations of space-based weapons and 
surveillance systems. The potential 
supportability requirements associated with 
large numbers of complex and expensive 
satellites were identified as critical 
issues in the development of these systems. 


3 . DIVERGENCE OF DOD AND NASA REQUIREMENTS 

Although DoD is following NASA's lead into 
orbital servicing and wishes to fully 
leverage NASA's experience and technology 
base in this area, there are significant 
differences between the needs and interests 


of the two agencies. NASA has developed a 
satellite servicing methodology and 
technology based upon astronauts performing 
EVA operations from the shuttle orbiter or, 
in future years, from the Space Station. 
As in the examples above, these operations 
take place in relatively low altitude earth 
orbits that can be reached by the shuttle 
orbiter. 

Most of the prospective DoD candidates for 
servicing would be located in high altitude 
or high inclination orbits which could not 
be reached by the shuttle. In addition to 
military space assets being difficult to 
reach, many of them are located in 
environments are hazardous to astronaut 
operations, such as the radiation belts. 
It is also recognized that performing an EVA 
is inherently a high risk operation. If 
space-based servicing were to be 
incorporated as an operational tool, a 
potentially large number of remote 
operations might be required. It is prudent 
to reduce the potential risk to human life 
if a suitable alternative can be made 
available. 

Another important difference between NASA 
and DoD requirements is the timeliness of 
response to problems. Most NASA systems are 
scientific satellites. The interruption of 
their data is an inconvenience that can 
generally be recovered from by later 
observation time. However, the critical 
defence missions of military satellites 
dictate that these systems be restored to 
full operational availability as quickly as 
possible after an anomaly. This may require 
timelines which are incompatible with the 
time required to schedule and launch a 
manned response but which can be met by a 
dedicated launch of a small unmanned system. 

These requirements have led the DoD to 
emphasize a robotic approach utilizing 
expendable launch vehicles for the servicing 
of space assets rather than the astronaut 
EVA approach developed by NASA. 


4. FAILURE MODES OF SPACE SYSTEMS 

The requirements definition for a space- 
based servicing system begins with an 
examination of situations for which 
servicing might be an appropriate response. 
These failure modes can be classified into 
several broad categories. The first of 
these catagories is the failure of a 
component which results in the partial or 
complete loss of system functionality. 
These failures will almost always be of a 
random nature, since almost the entire 
mission life falls within the regime 
described by the flat or random failure 
region of a standard "bathtub shaped" 
reliability curve, as shown in Figure 1. 
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There will be a relatively high rate of 
"infant mortality" early in the mission. 
With a few minor exceptions, the increase 
in failure rate associated with the wear out 
portion of the reliability curve is never 
reached . 

Since these failures can occur at any time 
(although concentrated early in the mission) 
and often without warning, they are the most 
stressing in the time required for a 
response . 

The second category is that of degradation 
in the performance of a component or 
subsystem. This type of failure has the 
effect of a gradual reduction in the 
performance margin of a system, sometimes 
reaching a threshold at which system 
functionality is lost. This usually gives 
ample time to plan a response, especially 
in cases where the rate of degradation can 
be well characterized. An example is 
degradation of solar cells due to radiation 
damage. 

A third life-limiting category is depletion 
of consumables. It is somewhat similar to 
degradation in that it is a time- or cycle- 
dependent phenomena, but fundamentally 
different on that the performance of the 
system is not affected until the consumable 
is depleted, at which time functionality is 
lost. Consumption of fuel in a propulsion 
system is a typical example. 

Another category where servicing might be 
beneficial is that of a system which has not 
failed, but has become outmoded. A 
capability of inserting upgraded technology 
into the basic system could extend the 
spacecraft 1 s useful life, enhance its mission 
capabilities and lower life cycle cost. 


There are three general types of responses 
available to life limiting issues or failure 
modes. The first of these is to change the 
design. If a mission is limited by 
depletion of a consumable, adding a larger 
amount of that consumable to the original 
design is more efficient than supplying more 
once the system is on station, provided that 
the additional mass is within the available 
launch capacity. Additional margin can be 
built into systems which suffer from 
degradation, with the same proviso on weight 
limitations. Reliability of complex systems 
can be improved by providing both component 
level and subsystem level redundancy. 
However, there is a limit to the level of 
redundancy which can be provided before the 
potential failures arising from the 
increased complexity outweigh the benefits. 
Launch weight limitations can be a factor 
here as well. 

A more sophisticated design change would be 
to change the function. Failure modes such 
as those associated with mechanical 
mechanisms can be designed out of the system 
or alternative approaches can be used for 
the overall system architecture. A subtle 
variant is to reconfigure the system by 
telemetry to "work around" anomalies. 

These design approaches are normally used 
to maximize service life, and will continue 
to be the most appropriate first response 
for failure modes which can be clearly 
identified . 

However, experience has shown that good 
design practice alone cannot eliminate on- 
orbit failures. The classical response to 
such failures is to abandon and replace the 
failed, degraded, or obsolete asset. This 
will continue to be the most appropriate 
response in some cases. 

The emerging alternative to abandonment of 
failed assets is on-orbit servicing. This 
response has been demonstrated on an ad-hoc 
basis on systems which were not originally 
designed for servicing, but offers the 
greatest promise if it is a basic design 
feature of the system. Servicing is not a 
universal panacea, but merely another tool 
which the system designer can exploit to 
achieve the most responsive concept. The 
economic viability of servicing is dependent 
upon the cost, weight, and inherent 
reliability of the satellite, launch costs, 
and the nature of the failure. It must be 
recognized that designing for servicing is 
an additional requirement which can conflict 
with other design requirements and may 
entail cost and mass penalties. However, 
these penalties may be offset by 
producibil ity and testing benefits as well 
the benefits gained by servicing. 
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In each case, the choice of whether the 
potentially mission limiting feature should 
be responded to by design changes or by 
operational servicing is a question to be 
decided on the basis of lowest cost, with 
the answer tempered by technical 
capabilities. For military systems, 
operational needs and availability will also 
be a strong consideration and may outweigh 
other factors. In many cases the optimum 
solution will utilize both approaches, with 
the system designed to provide the maximum 
possible life and servicing providing an 
extension in capability beyond thau 
constrained by engineering or initial launch 
weight . 


6. KEY SERVICING TECHNOLOGIES 

Our examination of the specific operations 
required to perform on-orbit servicing 
identified the technologies which must be 
developed to achieve this capability. We 
found these to be relatively few and well 
within current engineering practice. The 
most critical issue appears to be that of 
designing the systems for servicing. 

As we evaluated the details of how to 
perform servicing of failed or degraded 
components it became apparent that current 
military design practice is not compatible 
with robotic on-orbit servicing. Systems 
are assembled by building outward from a 
tightly packed interior. Components are 
integrated on equipment platforms and are 
thus largely inaccessible. It is pointless 
to debate the levels of robotic technology 
required when these tasks could not be 
performed even by an astronaut with a 
complete tool kit. 

The full benefits of on-orbit servicing can 
be achieved only if the spacecraft to be 
serviced is designed from its very inception 
with a large percentage of its systems 
modular and accessible. Robotic removal of 
these modules should also be a design 
consideration. This goal is best 
implemented by a spacecraft architecture 
featuring standard fittings, interfaces, and 
docking locations with the orbital 
replacement units (ORUs) located on an 
external frame where they are accessible. 

An important consequence of this modular 
architecture is that it implies a radically 
new manufacturing, test, and assembly flow. 
Modules can be built up in parallel and 
tested independently by plugging into 
spacecraft bus simulators. Errors could be 
detected and corrected at a lower level with 
less impact than in the traditional buildup 
of equipment platforms into spacecraft. 

The use of standard subsystem ORUs across 
several programs would enable an economy of 
scale to be achieve which could 
substantially reduce unit costs. The 


greater experience base for each hardware 
item would also allow the ultimate 
reliability rates to be improved over what 
they would be if a specific item were 
developed for each application. This module 
standardization and mass production also 
enhances the availability of production line 
spares. These spares and the ease of repair 
on the ORU level will reduce production 
delays on the system level. 

The synergistic relationship between 
modularity and serviceability recalls the 
experience of the Solar Max. The on-orbit 
repair which returned it to service was 
possible not because the MMS spacecraft had 
been designed to be serviceable but because 
it was designed to achieve the production 
and assembly benefits of modularity. The 
repair was an unanticipated benefit of the 
resultant accessibility. 

Our implementation analysis identified 
several technologies which are either 
enabling or enhancing to remote servicing 
missions. Three of these were judged to be 
key in that they must be demonstrated in 
order for on-orbit to be fully accepted as 
an operational concept. These are 
autonomous rendezvous and docking, robotic 
ORU replacement, and fluid transfer. 

It is possible to fly a rendezvous and 
docking mission entirely under remote 
piloted control. However, an autonomous 
system would significantly reduce 
operational support requirements and costs 
as well as provide higher reliability and 
more efficient propellant usage. This 
technique is regularly used by the USSR in 
supplying their space station but has not 
yet been demonstrated by the US. 

The location of many DoD assets in orbits 
with high radiation fluxes or other hazards 
makes it desirable to perform servicing 
robotically. Robotic replacement of ORUs 
by simple, well defined motion can be 
enabled by a standardization of docking 
locations and fittings. This can eliminate 
the requirement for highly capable robots 
with advanced sensing, manipulative, and 
cognitive capabilities. The man-in-the loop 
requirements will be minimized by the 
definition of the locations and motions to 
be executed. This autonomy reduces the 
criticality of the time delay in the 
feedback loop which has been seen as a limit 
to tele-operations. 

There is a trade-off between the degree of 
structure provided in the environment and 
the level of robotic technology required. 
It appears best to begin with a simple, 
structured system which has a growth path 
to higher complexity. The servicing robot 
would operate in the supervised autonomy 
mode, carrying out a series of pre- 
programmed "macro" instructions, pausing 
between each operation for verification and 
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authority to proceed. Manual override and 
tele-robotic operation would be available 
for dealing with unanticipated situations. 
It is important to design the robot to fail 
in a safe and recoverable mode and not 
induce failures on either the servicer or 
the spacecraft being serviced. 

The reduction of robotic operations to 
simple, well defined motions allows the 
robotic servicing subsystem to be very 
simple. This is a very important concept 
because this simplicity allows the robotic 
device to achieve a high level of 
reliability. On-orbit servicing can be 
economically viable only if the failure 
rates of the support system are extremely 
low. This simplicity also allows the 
robotic servicer to be developed with near- 
term technologies. 

The connectors and procedures for on-orbit 
fluid transfer comprise the third key 
technology which must be demonstrated. The 
replenishment of propellants or other fluids 
was identified as one of the prime 
candidates for on-orbit servicing. DoD has 
a near term interest in hydrazine for 
refuelling a variety of spacecraft in both 
low and high altitude orbits, with a longer 
term interest in liquid cryogens for 
propulsion or space-based weapons. NASA is 
interest is in supplying superfluid helium 
to scientific satellites such as the Space 
Infrared Telescope Facility (SERTF) . 

Since refuelling can be implemented with 
minimal impact upon the spacecraft 
architecture, its potential benefits have 
been examined in several government 
sponsored studies. The most recent of these 
was performed for Air Force Space Systems 
Division Long Range Planning and Development 
Office. The study found two classes of 
satellites which could benefit from on-orbit 
refuelling. These were satellites in low 
earth orbit which had a basic propulsion 
requirement for drag makeup, and those in 
geo-synchronous orbit which have a base 
requirement for station-keeping. In both 
cases, the benefits of refuelling were 
derived more from the operational 
flexibility of greater maneuver capability 
than by addressing the basic propulsion 
requirement . 

Analysis usually shows that the most cost- 
effective method of extending propulsion 
lifetime of satellites is to increase the 
size of the original fuel tanks, up to the 
limit imposed by booster capacity. If the 
remainder of the payload is of sufficiently 
high reliability and value, it can even pay 
to move to the next larger class of booster. 


The problem of matching the fuel capacity 
to the rest of the system lies in the nature 
of the failure rates of the rest of the 
system. The design life of the system, 


which is normally used for sizing of 
subsystems, is not a hard limit unless it 
is set by exhaustion of a consumable. It 
is not even marked by a cluster of expected 
failures unless system lifetime is dominated 
by wearout failures. System lifetime is 
usually determined by random failures which 
occur at an even rate once the infant 
mortality period is passed. Thus the design 
life is a statistical concept denoting the 
point at which the predicted availability 
falls below the system allocation. 



FIGURE 2 . SYSTEM RE UABUITY OR AY AdASIllTY 


The probability that a space system will be 
operating satisfactorily follows the pattern 
shown in Figure 2. There is an immediate 
drop in reliability due to the chance of 
failure during launch and deployment. The 
availability then decreases with time during 
the early infant mortality period, with the 
rate of failure decreasing as the random 
failure region is reached. The failure rate 
increases again if the wearout region is 
reached. However, depletion of a consumable 
such as fuel will usually terminate system 
operation before wearout is reached. A 
nominal design life point is shown. 

It is this statistical basis of the random 
failures that provides an economic incentive 
for refuelling. There will be systems which 
will reach the nominal design life without 
failure. If they are sufficiently far from 
a wearout mode limit they will be no more 
likely to fail during the next x years than 
they were during the first x years. 
Therefore, there is additional useful life 
which could be obtained by refuelling. The 
statistical chance that there might also be 
an unrecoverable failure early in the 
mission makes it unprofitable to oversize 
the fuel tanks to the point of requiring a 
larger booster. 

The economics and utility of refuelling can 
thus be seen to be justified primarily on 
a contingency basis. It is those off- 
nominal cases where the system is required 
to make unanticipated maneuvers, or when the 
system continues to operate successfully 
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beyond the nominal design lifetime that 
benefit from the capability to provide 
additional fluids in orbit. These benefits 
can be potentially large in relation to the 
costs required to achieve them. 


7. REQUIRED TECHNOLOGY DEMONSTRATIONS 

Spacecraft fluids can be classified by 
physical properties and hardware technology 
requirements into five general categories. 

Gases 

Monopropellants (includes water) 

Bipropellants 

Superfluid Helium 

All Other Cryogens 

There is nothing unique to the space 
environment which affects gas transfer, so 
its technology is well in hand. Supply and 
handling systems for the other four 
categories have each been given some 
development attention, and vary to the 
degree of technical maturity. 

The on-orbit transfer of hydrazine was 
demonstrated by an experiment in the shuttle 
payload bay in 1984. Hydrazine was 
transferred from one tank to another after 
a valve was opened by an astronaut. This 
resolved many of the issues associated with 
low-gravity fluid transfer, including 
adiabatic recompression. The Storable Fluid 
Management Experiment further resolved 
micro-gravity fluid handling issues by 
observing the behavior of water in a 
transparent tank in the shuttle mid-deck in 
1985. There are still some issues to 

further explored, such as mass gauging and 
robotic operation of "zero-leak" connectors 
under micro-gravity conditions. However, 
the physics is well understood and only a 
demonstration is required. 

NASA is current developing an on-orbit 
demonstration of superfluid helium transfer 
in the SHOOT (Superfluid Helium On Orbit 
Transfer) experiment. This will resolve 
many of the additional technical issues 
peculiar to this fluid such as the fluid 
transfer process and mechanisms, tank chill- 
down and venting operations in micro- 
gravity, and verification of thermal models 
for heat transfer within the tank due to 
mixing. 

A substantial amount of hardware supportive 
of on-orbit fluid transfer has been built 
and tested on the ground. Several prototype 
valves and connectors suitable for robotic 
operation have been developed under contract 
to NASA— JSC . An automatic fluid interface 
system (AFIS) which could hold these valves 
and act as a coupler between the servicer 
and target spacecraft has been built under 
contract to NASA-MSFC. 


Much of the remaining technical development 
required for an on-orbit fluid transfer 
system can be performed as part of an 
experiment within the shuttle payload bay. 
However, true confidence on the part of 
potential users will not be obtained until 
mating and fluid transfer is demonstrated 
on free-flying satellites. 

There is very little technology work 
required for an autonomous rendezvous and 
docking system, as all the requisite 
technologies exist as components. What 
remains to be done is the system integration 
and demonstration. The control system 
operation can be partially verified by a 
test and evaluation program which begins 
with software simulation and evolves into 
hardware-in-the-loop simulations on air- 
bearing tables. However, the final full-up 
demonstration of responses in all six 
dynamic dimensions must be achieved as a 
free-flying space experiment. Although 
preliminary development of the sensor 
systems can be done on ground test ranges, 
a space flight experiment will be required 
to verify performance at operational ranges 
against realistic backgrounds. 

The development and demonstration 
requirements for the robotic manipulator 
system parallel those for the docking 
control system. The control loops and end 
effector operation can largely be 
demonstrated on the ground in all aspects 
except those affected by micro-gravity. 
Manipulator arm dynamic response in a micro- 
gravity environment is important only for 
large, light assemblies such as those being 
developed for the Flight Telerobotic 
Servicer (FTS) . A simpler, more compact 
manipulator as described above might have 
enough stiffness to be verified in ground 
tests. The arm dynamics can be assessed as 
part of an attached shuttle payload 
experiment . 

The major dynamics issue which can be 
resolved only through a free-flight 
experiment, is the cross-coupling between the 
manipulator dynamics and the control systems 
of the servicer and target spacecraft. 

In addition to the extensive component 
development which has been carried out in 
each of the core enabling technology areas, 
there have been several attempts to 
integrate them into a full system 
demonstration. The most ambitious was the 
Satellite Servicer System Flight 
Demonstration which was jointly sponsored 
by NASA and DoD. This program was to have 
drawn upon the hardware base described above 
as well as the Orbital Maneuvering Vehicle 
(OMV) and FTS programs to produce a free 
flying orbital demonstration of the three 
critical servicing technologies. Budgetary 
constraints at the sponsoring agencies led 
to its cancellation just as the contractors 
were about to begin design definition work. 


211 



Air Force Space Systems Division recently 
sponsored a concept study addressing 
rendezvous, docking, and refuelling on a 
smaller scale using an expendable vehicle. 
This study was carried out by NASA-Jet 
Propulsion Laboratory. Various means of 
carrying this concept forth to a flight 
demonstration are under consideration. One 
promising approach might be to use the SPAS 
hardware owned by SDIO which has already 
flown twice and will be reused for several 
additional experiment payloads. 

We cannot ignore the fact that other nations 
have been active in this area, and the first 
flight demonstration may be performed by 
either the Japanese or Europeans. In 
particular, the Japanese ETS-7 spacecraft 
appears to have this as its goal. The ETS- 
7 will demonstrate the 3 key technologies 
described earlier. 


8. IMPLEMENTATION OF SERVICING 

One of the problems which must be addressed 
in order to obtain the benefits of on-orbit 
servicing is how this technology might be 
inserted into operational systems. There 
is a very long lead time in the development 
of new series of spacecraft and there is an 
understandable reluctance to make provisions 
for a capability which has not been fully 
integrated and demonstrated. Likewise, it 
is difficult to develop a support 
infrastructure in the absence of established 
users . 

An effective way to work out of this chicken 
and egg impasse might be to introduce 
servicing capabilities on a contingency 
basis. For example, a grappling fixture 
could be incorporated into a spacecraft 
design at minimal cost and mass penalty. 
There may not be plans to use this in the 
original operational concept, but it might 
enable some corrective action to be taken 
later in the case of unanticipated events, 
as has occurred so often in the past. 

Likewise, the capability for on-orbit 
refuelling could be provided at relatively 
low cost to the user. A fill valve is 
normally provided in spacecraft propulsion 
systems to allow the satellite to be fuelled 
shortly before launch. Making this valve 
compatible with robotic operations and 
allowing accessibility to it would enable 
on-orbit refuelling to take place at some 
future time, should the need arise and a 
servicing system be developed. 

These contingency provisions can be 
justified by the extremely high ratio of the 
benefits which might be achieved, if they 
were ever to be needed, to the relatively 
modest costs of incorporating them as 
standard spacecraft design features. 
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